Privacy
On your phone by default
You record on your iPhone, and by default the recording is transcribed on the phone too: with Apple's Speech Analyzer where iOS 26 supports it, otherwise with a Whisper model downloaded to the phone. When that happens, the audio does not leave the device.
Your recordings, transcripts, summaries and generated artefacts are kept in the app's library on the phone. There is no timer on them: they stay until you delete them. Deleting a sift from History removes its files from the phone, but not any cloud copies (see below) and not an open share link.
The app doesn't sync its library through iCloud, but it also doesn't exclude its files from your iPhone's own backups, so a device or iCloud backup can contain them. Exports you save or send (PDF, Markdown, audio and so on) are separate copies that the app can't recall.
What goes to the cloud
To build a sift, the app sends the text transcript to Google's Gemini models, either from the app through Firebase or through ThoughtSift's backend on Google's Firebase. The audio is not sent for this step.
Optional images are generated in the cloud from the sift's text, using Google's image models, or OpenAI's if you accept the in-app notice for them. Spoken narration is a generated voice reading the sift. It is normally made in the cloud from the sift's text; if that isn't available, the app makes it on the phone instead.
When you tap to create or regenerate a diagram, the backend sends the transcript or the selected sift content, its title and language to Anthropic's Claude models to draw it. A normal capture doesn't do this on its own. The request can also include a short, size-limited block from your profile record: themes and vocabulary picked out of your earlier sifts, and diagram type and style preferences. In the backend's source code, this step reads that record directly, with no separate check of the About Me personalisation setting. We haven't confirmed that the live backend matches this source, and we can't yet say when this will change.
The app signs you in with an anonymous account so the backend can tie these requests to you.
When your audio goes to the cloud
Only in two cases: you choose Cloud transcription in Settings, or on-device transcription can't run (for example, the Whisper model isn't downloaded yet, or the recording isn't in English) and you tap Send audio to cloud. If you tap Keep audio on this iPhone, nothing is sent and the recording is saved on the phone for a retry.
Recordings up to about 20 minutes and 14 MiB go straight from the app to Google's Firebase and Gemini services. Longer or larger recordings (anything over about 20 minutes, or over 14 MiB even if it's short) are first uploaded to a private folder for your account in ThoughtSift's storage. The limits are 30 minutes and a 32 MiB upload. Only your account can upload to that folder, and the storage rules don't let any app user read it back, you included. The backend then sends the file to Gemini for transcription and afterwards attempts to remove Gemini's temporary copy.
Who processes your data
Google Firebase and Google Cloud run ThoughtSift's backend: sign-in, the database, file storage, the backend functions, push notifications, app verification, and analytics and crash reports. The database and file storage are in Google Cloud's europe-west2 region (London). That is where ThoughtSift stores data; it is not a statement about where the AI providers below process it.
Google Gemini (Gemini Developer API) transcribes audio when cloud transcription is used, and builds sifts, narration and Google images. Google's published terms apply: the Gemini API terms, the usage policies and Firebase AI Logic data governance. ThoughtSift uses a paid (billing-enabled) project, so Google's paid-service terms apply. Google's published default is to keep prompts, inputs and outputs for 55 days for abuse monitoring. That is Google's default, not storage ThoughtSift controls, and removing Gemini's temporary file copy doesn't remove it.
Anthropic (Claude) draws diagrams when you ask for one. Anthropic's published default for its commercial API is to delete inputs and outputs within 30 days, with longer retention in the exceptions it lists. It doesn't offer ad-hoc deletion of data sent through the API. No zero-data-retention arrangement with Anthropic has been confirmed.
OpenAI generates images only if you choose an OpenAI image model and accept the in-app notice. It receives the image prompt and sift context. OpenAI's published default for its image API is to keep data for 30 days for abuse monitoring; account settings and its stated exceptions can change that.
Netlify hosts this website and the share pages, so it handles requests from people who visit them. Its Data Processing Agreement sets the terms for data it processes for its customers; Netlify's own privacy policy doesn't cover that data. How long Netlify keeps website visitor and request data for this site hasn't been confirmed.
These providers' periods are their own published defaults. They are separate from how long ThoughtSift keeps the results it stores, which is set out below.
What a share contains
A share holds the diagram, summary and section cards, plus the image if you leave it switched on. If narration is available, it holds that too. The transcript is included only if you switch Include transcript on, and it's off by default. Your recording is never part of a share.
Anyone with the link can open it. A link lasts 24 hours, then stops opening. An hourly job removes expired share records, which triggers a background clean-up of the share's uploaded files. You can turn a link off sooner with Disable public link: new requests through the share link stop working immediately, and a background clean-up then attempts to remove the files. Previously issued asset URLs or cached previews may remain available until they expire or are removed; successful removal of the files, and when it happens, are not guaranteed.
You can add a 4–6 digit PIN. Three wrong attempts lock the share. Without a PIN, chat apps show the sift's title and a short summary in the link preview. With a PIN, they don't. Copies someone saved while a link was open are outside ThoughtSift's control.
Reactions and notes viewers leave on a share, and the anti-abuse records behind them, are not currently removed when the share ends. They can stay after the link has expired or been turned off.
How long ThoughtSift keeps things in the cloud
Recordings uploaded for cloud transcription (the longer or larger ones above) are kept. There is currently no automatic deletion and no in-app way to delete them.
Transcription results (the transcript, summary and key points returned for an uploaded recording) are kept, with no automatic deletion and no in-app way to delete them.
Sift jobs. When a sift job finishes or fails normally, the backend removes the raw transcript it was sent. A job that stays queued, gets stuck or crashes may keep it. The results it keeps, which can include a cleaned-up transcript, the sift and diagram content, and settings, have no automatic deletion and no in-app way to delete them. Generated images stored with a job are the same.
Shares stop opening after 24 hours, as above. That is when access ends, not a promise that every copy is gone by then.
Your profile record. About Me details you add for personalisation stay until you delete them in the app. Separately, after each sift job completes, the backend asks Gemini to pick out themes and vocabulary from its transcript and adds them to the same record (up to 30 themes and 100 terms); in the source code this happens whether or not you've added About Me details or switched personalisation on, and the transcript is sent to Gemini for this. Deleting your About Me details removes that record, but later sifts start filling it again. Deleting it, or turning personalisation off, doesn't change sifts, diagrams or shares already made.
Deleting a sift on your phone, signing out, reinstalling or deleting the app does not delete any of these cloud copies.
Copies after deletion
In the configuration we checked in October 2026: when a file is deleted from ThoughtSift's storage, the storage service keeps a recoverable copy for 7 days, and the database keeps earlier versions of records for 1 hour. No scheduled database backups were set up, and point-in-time recovery was switched off. These are the settings we observed, not a promise that no other copies exist anywhere: device backups, exports and the AI providers' own records are separate.
Your account, devices and diagnostics
If the app has to create a new anonymous account (for example after signing out), data linked to the old one isn't erased. There is currently no way to delete your account and its cloud data from the app.
If you allow notifications, the app registers a push token with the backend. A token is replaced when the app refreshes it and removed when delivery shows it's no longer valid; there's no time limit on it otherwise.
In the app's code, Firebase Analytics is switched on by default and can be turned off in Settings. The app's crash reporting (Firebase Crashlytics) records errors and sanitised details; the code has no consent check or off switch for it. We haven't yet confirmed how either is configured on the live service, or what is actually collected. If you agree to share diagnostics, failures (for example when making or sharing a diagram fails) can upload a diagnostic snapshot holding up to 20 sanitised entries. Each failure can add another snapshot, so several can build up with your account, with no expiry and no in-app way to delete them yet. On the phone, usage records older than 90 days are filtered out when the app loads them and removed from the file the next time a usage record is saved, so this isn't a timed deletion; local diagnostics have no time limit.
The backend keeps operational logs and audit records. How long Google keeps those logs hasn't been confirmed.
What isn't decided yet
Who is legally responsible for your data (the controller), its address and country, the applicable law and regulator, the legal basis for processing, whether a data protection officer is needed, and the minimum age for using ThoughtSift.
How long to keep uploaded recordings, transcription results, sift results and generated images, and whether to delete them automatically.
Whether reactions, notes and anti-abuse records should be removed with their share, and whether to set a firm time by which share files are gone.
How long to keep diagnostics, analytics, crash reports, logs and audit records (including the website host's visitor and request data), and whether any should be optional.
Whether diagram requests should use your profile record only when About Me personalisation is on, and whether themes and vocabulary should be learned from your sifts without it.
An in-app way to delete your account and all its cloud data, what happens to inactive anonymous accounts and old push tokens, and whether app files should be left out of device backups.
How privacy requests are checked and handled for anonymous accounts.
Whether themes and vocabulary already learned from your sifts are kept, and whether deleting your profile should also reach sifts and diagrams already made with it (today it doesn't). Also whether to keep the recoverable-copy settings we observed: 7-day recovery of deleted files and 1-hour earlier versions of records.
These will come with the full privacy policy. Until then, please don't treat this page as one.
Questions
Questions: [email protected].